CVE-2026-27149: Discourse has SQL injection in PM tag filtering
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (listprivatemessagestag) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27149?
CVE-2026-27149 is classified as a high-severity vulnerability due to its potential to disclose unauthorized private message metadata.
How do I fix CVE-2026-27149?
To fix CVE-2026-27149, upgrade your Discourse installation to version 2025.12.2, 2026.1.1, or 2026.2.0 or later.
What software is affected by CVE-2026-27149?
CVE-2026-27149 affects Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0.
What type of vulnerability is CVE-2026-27149?
CVE-2026-27149 is an SQL injection vulnerability that allows bypassing tag filter conditions.
What can be compromised by exploiting CVE-2026-27149?
Exploitation of CVE-2026-27149 may lead to the disclosure of unauthorized metadata for private messages.